Troubleshoot login and access

Use OIDC login succeeds but access is wrong when authentication succeeds but membership, role, team, or authorization is unexpected. Compare the provider claims, normalized email, provisioning state, group/role mapping, and OpsKnight audit event without exposing tokens.